problem with web shield and slipstream

[sded]

From what I read from Lukor, having Webshield scan port 5400 (only), unchecking "ignore local traffic" and not adding "OptinProcess=SlipAccel.exe" to avast.ini should work; but you say it doesn't.   Have you upgraded to .635?  Many of the problems with webshield are caused by ZoneAlarm, though, as you have probably read.  Have you tried turning it off temporarily?  Suggestion for Sygate or Kerio is just because they have extensive logging of all the TCP traffic in the free versions (like the stuff I posted).   Maybe the traffic log will help us understand the problem better.

[guestja]

sded,
My avast is up to date. No, having webshield scan port 5400 only and unchecking ignore local traffic doesn't work.
Regarding the firewall, I just upgraded to win xp. (still not too familiar with it) and I was debating which firewall to use. Believe it or not I specifically chose Zone Alarm over Sygate because of comments from  vlk, technical  and others on this board regarding the local host issue that Sygate has!. Otherwise Sygate was what I was going to use. This is getting rather confusing.

I am going to try to keep this open in hope that vlk will come through and give a clarifying response as to what my options are now. Shut it off, wait for a fix, etc. It seems to me if the "masses" are going to use webshield. There has to be some clarity on how to set it up. I'm sure many are not able to follow some of the current discussions regarding it on this  board.

Thank you for the input you have given so far.

[xistenz]

Apparantly, the latest beta version should work with Sygate.

See: http://forum.avast.com/index.php?topic=12320.0

[sded]

Couple of easy things to try with ZoneAlarm.  Under Programs, set the avast programs and slipstream to all permit.  Under Firewall, add 127.0.0.1 to the trusted IP addresses (should be there implicitly, but?).  Then wait for Vik. 

[guestja]

sded. 
In an attempt to rule out Zone Alarm -  I turned  it off , (turned on win xp firewall) - still same result.

[guestja]

vlk, if you read this: Was it your conclusion that it is not possible  to block infected downloads with web shield if you use a web accelerator?  if not, is there any other benefit to leaving it running?

[lukor]

Guestja, it is absolutely possible to configure webshield to be running with web accelerator.

The solution Technical offered, that is: monitoring port 5400 (and perhaps 80 as well) and monitoring localhost connections (that is: Ignore localhost is turned off) should be working. The question now should be why it does not work???

But you have plenty of other configuration options. For the startup lets try if webshield is working on your PC when configured as a proxy.

[guestja]

OK,
Using Fire Fox with settings as listed above (and avast WebShield set to default) it does not work.

It did work in Internet Explorer, but only when I had slipstream turned off. (But I only use internet eXplorer for updates to windows)

[lukor]

OK,
Using Fire Fox with settings as listed above (and avast WebShield set to default) it does not work.

Does not work? So, do you see an error message or can't you browse the web? How does it not work?

Thanks.

[guestja]

It does not work in that: If I attempt to download the eicar test file Avast detects it and offers me the option to delete it etc., instead of "aborting the connection" before download as it should.

(it used to work if I changed my settings to "direct connection to the internet"  - but now I can no longer get it to work that way either.)

[lukor]

It does not work in that: If I attempt to download the eicar test file Avast detects it and offers me the option to delete it etc., instead of "aborting the connection" before download as it should.

What happens if you turn the slipstream accelerator off? Also please see the avast's Resident protection control dialog if Web Shield provider is started and that it shows: "The provider is currently running". Next verify that "Enable Web Scanning" option in the Web Shield configuration dialog is checked.

Lukas.

[guestja]

with slipstream turned off, and web shield verified as running and "enable web scanning" checked, the web shield does not abort the connection when I attempt to download the eicar test file.

As an aside I went back and set local host to 5400 (for slipstream) and went to avast webshield custom and set redirected http ports to   80,5400 and unchecked "ignore local communication" and it doesn't work either. Also added optinprocess=slipaccel.exe under "webscanner" after" ignore local host=0"
Is this the setup that should work? is the optinprocess necessary?

could the problem be with firefox? Thanks

[lukor]

with slipstream turned off, and web shield verified as running and "enable web scanning" checked, the web shield does not abort the connection when I attempt to download the eicar test file.

As an aside I went back and set local host to 5400 (for slipstream) and went to avast webshield custom and set redirected http ports to   80,5400 and unchecked "ignore local communication" and it doesn't work either. Also added optinprocess=slipaccel.exe under "webscanner" after" ignore local host=0"
Is this the setup that should work? is the optinprocess necessary?

could the problem be with firefox? Thanks

Guestja,

as I said before, the optinprocess=slipaccel.exe is not only unnecessary, it will bring you troubles if only the Slipstream accelerator would use the port 80 or 5400 internally. So please remove this. Unfortunately SlipStream uses LSP privder to gather the connections from browser, so it's hard to chain before it.

Please try the following settings:

1) Web Shield: enabled, redirect port 80, ignore local communication: checked
2) SlipStream accelerator: Settings / Features / Proxy exclusion:  Specify a proxy exclusion list - in the list enter: localhost

It seem to work for me, but as I don't have login name/password, I can only guess.
Lukor.

[guestja]

lukor,
With the settings as above, I still do not get the "abort connection".  (I have my connection settings in fire fox set to "manual proxy configuration" local host 5400," for slipstream to work)

I also tried changing the setting in firefox to "direct connection to the internet" - didn't help

tried: "manual proxy configuration local host" to 12080 - no change,  -    returned to 5400

I'm not sure if I have been clear on the point that when I have the "manual proxy configuration" set for localhost 5400, slipstream has been working - the only problem is that I do not get the "abort connection" signifying that the web shield is functioning  when I download the eicar test file. Thanks

[guestja]

Lukor,
Unless you have any more ideas I guess I will have to shut off webshield. I get too much benefit from slipstream to remove it. I will re-open the topic again after webshield has been out for awhile. Thank you for your time and responses.